Tinacms
Monthly
Off-origin preview framing in TinaCMS (tinacms <= 3.13.0 and @tinacms/app <= 2.5.13) lets an unauthenticated attacker who convinces a signed-in editor to open a crafted link such as `#/~//attacker.example/p` make the admin load and trust an attacker-controlled iframe, which is then accepted as the legitimate preview over the admin↔preview postMessage channel. Because the admin executes any GraphQL operation coming from that frame using the editor's own token, the attacker gains the editor's content API read and write access, exposing or modifying protected content. Exploitation needs only one click by an authenticated editor against a default configuration; no public exploit code was identified at time of analysis, and vendor-released patches are available in tinacms 3.14.0 and @tinacms/app 2.5.14.
Stored cross-site scripting in TinaCMS's @tinacms/web-components package (all versions up to and including 0.2.0) lets an authenticated content author save a rich-text link whose URL uses a script-capable scheme such as javascript:, which the tina-markdown element then writes straight into an anchor href; a visitor who clicks the rendered link executes attacker-controlled script in the site's origin. Because the payload persists in CMS content and runs in the victim's origin, an editor or administrator who clicks it can expose TinaCMS admin credentials held on that site (CVSS 7.6, AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N, CWE-79). Key prerequisites are an author-level account, a deployment that renders content via the web-components renderer rather than the sanitizing React, static, or Astro renderers, and a victim click; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Code injection in @tinacms/cli versions up to and including 2.7.0 lets a crafted Git branch name break out of the string literal used for the generated client's API URL and execute arbitrary JavaScript when that generated client module is imported during a preview or CI build. The flaw, rated CVSS 8.2 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N), requires the build to actually run codegen and import the generated client, and requires an attacker able to influence the branch value read from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, so exploitation is gated by meaningful preconditions rather than being trivially remote. Injected code runs with build-process privileges, allowing theft of environment credentials, tampering with deployment artifacts, and outbound network requests; no public exploit tooling identified at time of analysis, though the vendor advisory documents a working proof-of-concept branch-name payload, and there is no evidence of active exploitation (no CISA KEV listing) or EPSS data provided.
Cross-tenant authorization bypass in TinaCMS self-hosted deployments allows any holder of a legitimate TinaCloud account and its valid bearer token to read, create, update, delete, and manage media on a victim site without any victim account or interaction. The flaw affects @tinacms/auth before 1.1.4 and the next-tinacms-azure adapter before 15.0.1, where the server-side isAuthorized helper trusts a request-supplied clientID and therefore validates the attacker's token against the attacker's own TinaCloud app rather than the site's configured app (CWE-639, CVSS 8.8, PR:L). Exploitation is authenticated from the attacker's perspective - the attacker must already control a TinaCloud-verifiable token, so any TinaCloud account suffices - while no public exploit code was identified at time of analysis and the vendor has released patched versions.
Cross-site request forgery in the TinaCMS CLI dev server allows an attacker-controlled web page to write arbitrary files into a developer's local media root without their knowledge. The Vite dev server's CORS middleware only suppressed response headers for disallowed origins but never terminated the underlying request, and because multipart/form-data is a browser 'simple request' exempt from CORS preflight, an attacker page can silently drive a complete media upload to completion. Exploitation requires the targeted developer to visit an attacker-controlled page while tinacms dev is running locally; no public exploit identified at time of analysis, though a researcher-validated proof-of-concept is documented in GHSA-rgr9-r7mj-mf6x. Vendor-released patch: @tinacms/cli@2.5.2.
Broken access control across all four first-party TinaCMS production media adapters (next-tinacms-s3, next-tinacms-dos, next-tinacms-azure, next-tinacms-cloudinary) allows any authenticated CMS editor to write or delete storage objects outside the operator-configured mediaRoot boundary. The handlers pass attacker-controlled query parameters (req.query.key for presigned S3 PUTs, req.query.media for DELETEs) directly to storage SDK operations without validating that the resulting key falls within the permitted path prefix, giving editors write and delete authority over the entire storage bucket or container reachable by the deployment's IAM or service credential. Vendor-released patches exist in all four packages; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in TinaCMS affects versions prior to 3.1.1, @tinacms/cli before 2.0.4, and @tinacms/graphql before 2.0.3. Authenticated attackers with content control over markdown files can execute arbitrary code through insecure gray-matter package usage. The vulnerability requires low-privilege authentication (PR:L) and user interaction (UI:P), enabling full compromise of confidentiality, integrity, and availability in the vulnerable context. Publicly available exploit code exists, significantly increasing deployment risk for unpatched installations managing user-contributed markdown content.
Off-origin preview framing in TinaCMS (tinacms <= 3.13.0 and @tinacms/app <= 2.5.13) lets an unauthenticated attacker who convinces a signed-in editor to open a crafted link such as `#/~//attacker.example/p` make the admin load and trust an attacker-controlled iframe, which is then accepted as the legitimate preview over the admin↔preview postMessage channel. Because the admin executes any GraphQL operation coming from that frame using the editor's own token, the attacker gains the editor's content API read and write access, exposing or modifying protected content. Exploitation needs only one click by an authenticated editor against a default configuration; no public exploit code was identified at time of analysis, and vendor-released patches are available in tinacms 3.14.0 and @tinacms/app 2.5.14.
Stored cross-site scripting in TinaCMS's @tinacms/web-components package (all versions up to and including 0.2.0) lets an authenticated content author save a rich-text link whose URL uses a script-capable scheme such as javascript:, which the tina-markdown element then writes straight into an anchor href; a visitor who clicks the rendered link executes attacker-controlled script in the site's origin. Because the payload persists in CMS content and runs in the victim's origin, an editor or administrator who clicks it can expose TinaCMS admin credentials held on that site (CVSS 7.6, AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N, CWE-79). Key prerequisites are an author-level account, a deployment that renders content via the web-components renderer rather than the sanitizing React, static, or Astro renderers, and a victim click; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Code injection in @tinacms/cli versions up to and including 2.7.0 lets a crafted Git branch name break out of the string literal used for the generated client's API URL and execute arbitrary JavaScript when that generated client module is imported during a preview or CI build. The flaw, rated CVSS 8.2 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N), requires the build to actually run codegen and import the generated client, and requires an attacker able to influence the branch value read from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, so exploitation is gated by meaningful preconditions rather than being trivially remote. Injected code runs with build-process privileges, allowing theft of environment credentials, tampering with deployment artifacts, and outbound network requests; no public exploit tooling identified at time of analysis, though the vendor advisory documents a working proof-of-concept branch-name payload, and there is no evidence of active exploitation (no CISA KEV listing) or EPSS data provided.
Cross-tenant authorization bypass in TinaCMS self-hosted deployments allows any holder of a legitimate TinaCloud account and its valid bearer token to read, create, update, delete, and manage media on a victim site without any victim account or interaction. The flaw affects @tinacms/auth before 1.1.4 and the next-tinacms-azure adapter before 15.0.1, where the server-side isAuthorized helper trusts a request-supplied clientID and therefore validates the attacker's token against the attacker's own TinaCloud app rather than the site's configured app (CWE-639, CVSS 8.8, PR:L). Exploitation is authenticated from the attacker's perspective - the attacker must already control a TinaCloud-verifiable token, so any TinaCloud account suffices - while no public exploit code was identified at time of analysis and the vendor has released patched versions.
Cross-site request forgery in the TinaCMS CLI dev server allows an attacker-controlled web page to write arbitrary files into a developer's local media root without their knowledge. The Vite dev server's CORS middleware only suppressed response headers for disallowed origins but never terminated the underlying request, and because multipart/form-data is a browser 'simple request' exempt from CORS preflight, an attacker page can silently drive a complete media upload to completion. Exploitation requires the targeted developer to visit an attacker-controlled page while tinacms dev is running locally; no public exploit identified at time of analysis, though a researcher-validated proof-of-concept is documented in GHSA-rgr9-r7mj-mf6x. Vendor-released patch: @tinacms/cli@2.5.2.
Broken access control across all four first-party TinaCMS production media adapters (next-tinacms-s3, next-tinacms-dos, next-tinacms-azure, next-tinacms-cloudinary) allows any authenticated CMS editor to write or delete storage objects outside the operator-configured mediaRoot boundary. The handlers pass attacker-controlled query parameters (req.query.key for presigned S3 PUTs, req.query.media for DELETEs) directly to storage SDK operations without validating that the resulting key falls within the permitted path prefix, giving editors write and delete authority over the entire storage bucket or container reachable by the deployment's IAM or service credential. Vendor-released patches exist in all four packages; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in TinaCMS affects versions prior to 3.1.1, @tinacms/cli before 2.0.4, and @tinacms/graphql before 2.0.3. Authenticated attackers with content control over markdown files can execute arbitrary code through insecure gray-matter package usage. The vulnerability requires low-privilege authentication (PR:L) and user interaction (UI:P), enabling full compromise of confidentiality, integrity, and availability in the vulnerable context. Publicly available exploit code exists, significantly increasing deployment risk for unpatched installations managing user-contributed markdown content.